Internet Management: Limited Progress on Privatization Project Makes Outcome Uncertain (12-JUN-02, GAO-02-805T). This report discusses privatizing the management of the Internet domain name system. This system is a vital aspect of the Internet that works like an automated telephone directory, allowing users to reach Web sites using easy-to-understand domain names like www.senate.gov, instead of the string of numbers that computers use when communicating with each other. The U.S. government supported the development of the domain name system, and, in 1997, the President charged the Department of Commerce with transitioning it to private management. The Department issued a policy statement, called the ''White Paper,'' that defined the four guiding principles for the privatization effort as stability, competition, representation, and private, bottom-up coordination. After reviewing several proposals from private sector organizations, the Department chose the Internet Corporation for Assigned Names and Numbers (ICANN), a non-for-profit corporation, to carry out the transition. In November 1998, the Department entered into an agreement with ICANN in the form of a Memorandum of Understanding (MOU) under which the two parties agreed to collaborate on a joint transition project. Progress on and completion of each task is assessed by the Department on a case-by-case basis, with input from ICANN. The timing and eventual outcome of the transition remains highly uncertain. ICANN has made significant progress in carrying out MOU tasks related to one of the guiding principles of the transition effort--increasing competition--but progress has been much slower in the areas of increasing the stability and security of the Internet; ensuring representation of the Internet community in domain name policy-making; and using private bottom-up coordination. Although the transition is well behind schedule, the Department's public assessment of the progress being made on the transition has been limited for several reasons. First, the Department carries out its oversight of ICANN's MOU-related activities mainly through informal discussions with ICANN officials. Second, although the transition is past its original September 2000 completion date, the Department has not provided a written assessment of ICANN's progress since mid-1999. Third, although the Department stated that it welcomed the call for the reform of ICANN, they have not yet taken public position on reforms being proposed. -------------------------Indexing Terms------------------------- REPORTNUM: GAO-02-805T ACCNO: A03582 TITLE: Internet Management: Limited Progress on Privatization Project Makes Outcome Uncertain DATE: 06/12/2002 SUBJECT: Privatization Internet ****************************************************************** ** This file contains an ASCII representation of the text of a ** ** GAO Product. ** ** ** ** No attempt has been made to display graphic images, although ** ** figure captions are reproduced. Tables are included, but ** ** may not resemble those in the printed version. ** ** ** ** Please see the PDF (Portable Document Format) file, when ** ** available, for a complete electronic file of the printed ** ** document's contents. ** ** ** ****************************************************************** GAO-02-805T Testimony Before the Subcommittee on Science, Technology, and Space, Committee on Commerce, Science, and Transportation, U. S. Senate United States General Accounting Office GAO For Release on Delivery Expected at 2: 30 p. m. EDT Wednesday June 12, 2002 INTERNET MANAGEMENT Limited Progress on Privatization Project Makes Outcome Uncertain Statement of Peter Guerrero Director, Physical Infrastructure Issues GAO- 02- 805T Page 1 GAO- 02- 805T Mr. Chairman and Members of the Subcommittee: We appreciate the opportunity to provide testimony today on the important issue of privatizing the management of the Internet domain name system. This system is a vital aspect of the Internet that works like an automated telephone directory, allowing users to reach Web sites using easy- to- understand domain names like www. senate. gov, instead of the string of numbers that computers use when communicating with each other. As you know, the U. S. government supported the development of the domain name system and, in 1997, the President charged the Department of Commerce with transitioning it to private management. The Department subsequently issued a policy statement, called the ?White Paper,? that defined the following four guiding principles for the privatization effort: Stability: The U. S. government should end its role in the domain name system in a manner that ensures the stability of the Internet. During the transition, the stability of the Internet should be the first priority and a comprehensive security strategy should be developed. Competition: Where possible, market mechanisms that support competition and consumer choice should drive the management of the Internet because they will lower costs, promote innovation, encourage diversity, and enhance user choice and satisfaction. Representation: The development of sound, fair, and widely accepted policies for the management of the domain name system will depend on input from the broad and growing community of Internet users. Management structures should reflect the functional and geographic diversity of the Internet and its users. Private, bottom- up coordination: Where coordinated management is needed, responsible private- sector action is preferable to government control. The private process should, as far as possible, reflect the bottomup governance that has characterized development of the Internet to date. After reviewing several proposals from private sector organizations, the Department chose the Internet Corporation for Assigned Names and Numbers (ICANN), a not- for- profit corporation, to carry out the transition. In November 1998, the Department entered into an agreement with ICANN in the form of a Memorandum of Understanding (MOU) under which the two parties agreed to collaborate on a joint transition project. The Department emphasized that the MOU was an essential means for the Department to ensure the continuity and stability of the domain name management functions that were then being performed by, or on the behalf of, the U. S. government. The MOU states that before making a Page 2 GAO- 02- 805T transition to private sector management, the Department requires assurances that the private sector has the capability and resources to manage the domain name system. To gain these assurances, the Department and ICANN agreed in the MOU to complete a set of transition tasks. The Department?s tasks mainly relate to providing advice, coordination with foreign governments, and general oversight of the transition. ICANN agreed to undertake tasks that call for it to design, develop, and test procedures that could be used to manage the domain name system. Collectively, ICANN?s tasks address all four of the transition?s guiding principles. Progress on and completion of each task is assessed by the Department on a case- by- case basis, with input from ICANN. Any amendments to the MOU, such as removing tasks, must be approved by both parties. However, the Department retains responsibility for determining when management of the domain name system will be transitioned to ICANN, using the procedures tested during the transition. The original MOU was scheduled to expire on September 2000. Because work on the transition was not completed within the original transition time frame, the MOU was amended several times, and its time frame extended twice. The amended MOU is currently due to expire in September 2002. My testimony today responds to Senator Burns? request that we review (1) ICANN?s progress in carrying out the transition, and (2) the Department?s assessment of the transition. To address these issues, we spoke with officials from the Department of Commerce and ICANN, as well as members of ICANN?s Board of Directors and outside experts. We also reviewed relevant documents and attended public meetings of ICANN. We conducted our work from June 2001 through May 2002 in accordance with generally accepted government auditing standards. In summary, we found that the timing and eventual outcome of the transition remains highly uncertain. ICANN has made significant progress in carrying out MOU tasks related to one of the guiding principles of the transition effort- increasing competition- but progress has been much slower in the areas of increasing the stability and security of the Internet; ensuring representation of the Internet community in domain name policymaking; and using private, bottom- up coordination. For example, despite years of debate, ICANN has not yet decided on a way to represent the globally and functionally diverse group of Internet stakeholders within its decision- making processes. Earlier this year, ICANN?s president concluded that ICANN faced serious problems in accomplishing the transition and would not succeed in accomplishing its assigned mission without Page 3 GAO- 02- 805T fundamental reform. Several of his proposed reforms were directed at increasing participation in ICANN by national governments, business interests, and other Internet stakeholders; revamping the composition of ICANN?s Board and the process for selecting Board members; and establishing broader funding for ICANN?s operations. In response, ICANN?s Board established an internal committee to recommend options for reform. The committee?s May 31, 2002, report built on several of the president?s proposals and made recommendations involving, among other things, changes to ICANN?s organizational structure. The Board plans to discuss the committee?s recommendations at ICANN?s upcoming meeting in Bucharest in late June 2002. Although the transition is well behind schedule, the Department?s public assessment of the progress being made on the transition has been limited for several reasons. First, the Department carries out its oversight of ICANN?s MOU- related activities mainly through informal discussions with ICANN officials. As a result, little information is made publicly available. Second, although the transition is past its original September 2000 completion date, the Department has not provided a written assessment of ICANN?s progress since mid- 1999. The MOU required only a final joint project report. Just prior to the ICANN president?s announcement of ICANN?s serious problems, Department officials told us that substantial progress had been made on the project, though they would not speculate on ICANN?s ability to complete the transition tasks before September 2002, when the current MOU is set to expire. Third, although the Department stated that it welcomed the call for the reform of ICANN, they have not yet taken a public position on reforms being proposed. They noted that the Department is following ICANN?s reform effort closely, and is consulting with U. S. business and public interest groups and foreign governments to gather their views on this effort. Because the Department is responsible for gaining assurance, as the steward of the transition process, that ICANN has the resources and capability to manage the domain name system, we are recommending that the Secretary of Commerce issue a status report assessing the transition?s progress, the work that remains to be done, and the estimated timeframe for completing it. In addition, the report should discuss any changes to the transition tasks or the Department?s relationship with ICANN that result from ICANN?s reform initiative. We discussed our characterization of ICANN?s progress and the Department?s assessment of the transition with officials from the Department, who stated that they generally agree with GAO?s characterization of the Department?s relationship with ICANN and Page 4 GAO- 02- 805T indicated that it would take our recommendation with respect to an interim report under consideration. From its origins as a research project sponsored by the U. S. government, the Internet has grown increasingly important to American businesses and consumers, serving as the host for hundreds of billions of dollars of commerce each year. 1 It is also a critical resource supporting vital services, such as power distribution, health care, law enforcement, and national defense. Similar growth has taken place in other parts of the world. The Internet relies upon a set of functions, called the domain name system, to ensure the uniqueness of each e- mail and Web site address. The rules that govern the domain name system determine which top- level domains (the string of text following the right- most period, such as .gov) are recognized by most computers connected to the Internet. The heart of this system is a set of 13 computers called ?root servers,? which are responsible for coordinating the translation of domain names into Internet addresses. Appendix I provides more background on how this system works. The U. S. government supported the implementation of the domain name system for nearly a decade, largely through a Department of Defense contract. Following a 1997 presidential directive, the Department of Commerce began a process for transitioning the technical responsibility for the domain name system to the private sector. After requesting and reviewing public comments on how to implement this goal, in June 1998 the Department issued a general statement of policy, known as the ?White Paper.? In this document, the Department stated that because the Internet was rapidly becoming an international medium for commerce, education, and communication, the traditional means of managing its technical functions needed to evolve as well. Moreover, the White Paper stated the U. S. government was committed to a transition that would allow the private sector to take leadership for the management of the domain name system. Accordingly the Department stated that the U. S. government was 1 For example, a March 2001 report by the Census Bureau estimated that online business accounted for $485 billion in shipments for manufacturers and $134 billion in sales for wholesalers in the United States in 1999. The Census data include transactions conducted over the Internet and private data networks. For more details, see http:// www. census. gov/ estats/. Background Page 5 GAO- 02- 805T prepared to enter into an agreement to transition the Internet?s name and number process to a new not- for- profit organization. At the same time, the White Paper said that it would be irresponsible for the U. S. government to withdraw from its existing management role without taking steps to ensure the stability of the Internet during the transition. According to Department officials, the Department sees its role as the responsible steward of the transition process. Subsequently, the Department entered into an MOU with ICANN to guide the transition. ICANN has made significant progress in carrying out MOU tasks related to one of the guiding principles of the transition effort- increasing competition. However, progress has been much slower on activities designed to address the other guiding principles: increasing the stability and security of the Internet; ensuring representation of the Internet community in domain name policy- making; and using private, bottom- up coordination. Earlier this year, ICANN?s president concluded that ICANN faced serious problems in accomplishing the transition and needed fundamental reform. In response, ICANN?s Board established an internal committee to recommend options for reform. ICANN made important progress on several of its assigned tasks related to promoting competition. At the time the transition began, only one company, Network Solutions, was authorized to register names under the three publicly available top- level domains (. com, .net, and .org). In response to an MOU task calling for increased competition, ICANN successfully developed and implemented procedures under which other companies, known as registrars, could carry out this function. As a result, by early 2001, more than 180 registrars were certified by ICANN. The cost of securing these names has now dropped from $50 to $10 or less per year. Another MOU task called on ICANN to expand the pool of available domain names through the selection of new top- level domains. To test the feasibility of this idea, ICANN?s Board selected seven new top- level domains from 44 applications; by March 2002, it had approved agreements with all seven of the organizations chosen to manage the new domains. At a February 2001 hearing before a Subcommittee of the U. S. House of Representatives, witnesses presented differing views on whether the selection process was transparent and based on clear criteria. 2 ICANN?s 2 The hearing took place before the House Committee on Energy and Commerce, Subcommittee on Telecommunications and the Internet, on February 8, 2001. ICANN Has Increased Competition, But Progress Has Been Much Slower on other Key Issues ICANN Has Increased Domain Name Competition Page 6 GAO- 02- 805T internal evaluation of this test was still ongoing when we finished our audit work in May 2002. Several efforts to address the White Paper?s guiding principle for improving the security and stability of the Internet are behind schedule. These include developing operational requirements and security policies to enhance the stability and security of the domain name system root servers, and formalizing relationships with other entities involved in running the domain name system. Recent reports by federally sponsored organizations have highlighted the importance of the domain name system to the stability and security of the entire Internet. A presidential advisory committee reported in 1999 that the domain name system is the only aspect of the Internet where a single vulnerability could be exploited to disrupt the entire Internet. 3 More recently, the federal National Infrastructure Protection Center issued several warnings in 2001 stating that multiple vulnerabilities in commonly used domain name software present a serious threat to the Internet infrastructure. In recognition of the critical role that the domain name system plays for the Internet, the White Paper designated the stability and security of the Internet as the top priority of the transition. The MOU tasked ICANN and the Department with developing operational requirements and security policies to enhance the stability and security of the root servers- the computers at the heart of the domain name system. In June 1999, ICANN and the Department entered into a cooperative research and development agreement to guide the development of these enhancements, with a final report expected by September 2000. This deadline was subsequently extended to December 2001 and the MOU between ICANN and the Department was amended to require the development of a proposed enhanced architecture (or system design) for root server security, as well as a transition plan, procedures, and implementation schedule. An ICANN advisory committee, made up of the operators of the 13 root servers and representatives of the Department, is coordinating research on this topic. Although the chairman of the committee stated at ICANN?s November 2001 meeting that it would finish 3 President?s National Security Telecommunications Advisory Committee, Network Group Internet Report: An Examination of the NS/ EP Implications of Internet Technologies, (Washington, D. C.: June 1999). Efforts to Improve Stability and Security Are Behind Schedule Page 7 GAO- 02- 805T its report by February or March 2002, it had not completed the report as of May 2002. To further enhance the stability of the Internet, the White Paper identified the need to formalize the traditionally informal relationships among the parties involved in running the domain name system. The White Paper pointed out that many commercial interests, staking their future on the successful growth of the Internet, were calling for a more formal and robust management structure. In response, the MOU and its amendments included several tasks that called on ICANN to enter into formal agreements with the parties that traditionally supported the domain name system through voluntary efforts. However, as of May 2002, few such agreements had been signed. ICANN?s Board has approved a model agreement to formalize the relationship between the root server operators and ICANN, but no agreements had been reached with any of the operators as of May 2002. Similarly, there are roughly 240 country- code domains (2- letter top- level domains reserved mainly for national governments), such as .us for the United States. As with the root servers, responsibility for these domains was originally given by the Internet?s developers to individuals who served as volunteers. Although the amended MOU tasked ICANN with reaching contractual agreements with these operators, it has reached agreements with only 2 domain operators as of May 2002. 4 Finally, the amended MOU tasked ICANN with reaching formal agreements with the Regional Internet Registries, each of which is responsible for allocating Internet protocol numbers to users in one of three regions of the world. 5 The registries reported that progress was being made on these agreements, though none had been reached as of May 2002. Progress has also been slow regarding the other two guiding principles outlined in the White Paper, which call for the creation of processes to represent the functional and geographic diversity of the Internet, and for the use of private, bottom- up coordination in preference to government control. In order for the private sector organization to derive legitimacy from the participation of key Internet stakeholders, the White Paper suggested the idea of a board of directors that would balance the interests 4 ICANN signed agreements with the operators responsible for the .au (Australia) and .jp (Japan) country- code domains and their respective governments. 5 The areas of responsibility for the three Regional Internet Address Registries are: the Western Hemisphere and southern Africa, Europe and northern Africa, and Asia. Slow Progress for Creating Processes to Ensure Representation and Bottom- up Coordination Page 8 GAO- 02- 805T of various Internet constituencies, such as Internet service providers, domain name managers, technical bodies, and individual Internet users. The White Paper also suggested the use of councils to develop, recommend, and review policies related to their areas of expertise, but added that the board should have the final authority for making policy decisions. The Department reinforced the importance of a representative board in a 1998 letter responding to ICANN?s initial proposal. The Department?s letter cited public comments suggesting that without an open membership structure, ICANN would be unlikely to fulfill its goals of private, bottom- up coordination and representation. ICANN?s Board responded to the Department by amending its bylaws to make it clear that the Board has an ?unconditional mandate? to create a membership structure that would elect at- large directors on the basis of nominations from Internet users and other participants. To implement these White Paper principles, the MOU between ICANN and the Department includes two tasks: one relating to developing mechanisms that ensure representation of the global and functional diversity of the Internet and its users, and one relating to allowing affected parties to participate in the formation of ICANN?s policies and procedures through a bottom- up coordination process. In response to these two tasks, ICANN adopted the overall structure suggested by the White Paper. First, ICANN created a policy- making Board of Directors. The initial Board consisted of ICANN?s president and 9 at- large members who were appointed at ICANN?s creation. ICANN planned to replace the appointed at- large Board members with 9 members elected by an open membership to reflect the diverse, worldwide Internet community. Second, ICANN organized a set of three supporting organizations to advise its Board on policies related to their areas of expertise. One supporting organization was created to address Internet numbering issues, one was created to address protocol development issues, and one was created to address domain name issues. 6 Together these three supporting organizations selected 9 additional members of ICANN?s Board- 3 from each organization. Thus, ICANN?s Board was initially designed to reflect the balance of interests described in the White Paper. Figure 1 illustrates the relationships among ICANN?s supporting organizations and its Board of Directors, as well as several advisory committees ICANN also created to provide input without formal representation on its Board. 6 In the context of ICANN?s responsibilities, protocols are the technical rules that allow communications among networks. Page 9 GAO- 02- 805T Figure 1: Structure of Board of Directors Approved in May 2000 Source: Information provided by ICANN. Despite considerable debate, ICANN has not resolved the question of how to fully implement this structure, especially the at- large Board members. Specifically, in March 2000, ICANN?s Board noted that extensive discussions had not produced a consensus regarding the appropriate method to select at- large representatives. The Board therefore approved a compromise under which 5 at- large members would be elected through regional, online elections. In October 2000, roughly 34,000 Internet users around the world voted in the at- large election. The 5 successful candidates joined ICANN?s Board in November 2000, replacing interim Board members. Four of the appointed interim Board members first nominated in ICANN?s initial proposal continue to serve on the Board. Parallel with the elections, the Board also initiated an internal study to evaluate options for selecting at- large Board members. In its November 2001 report, the committee formed to conduct this study recommended the creation of a new at- large supporting organization, which would select 6 Board members through regional elections. Overall, the number of atlarge seats would be reduced from 9 to 6, and the seats designated for Page 10 GAO- 02- 805T other supporting organizations would increase from 9 to 12. 7 A competing, outside study by a committee made up of academic and nonprofit interests recommended continuing the initial policy of directly electing at- large Board members equal to the number selected by the supporting organizations. This committee also recommended strengthening the atlarge participation mechanisms through staff support and a membership council similar to those used by the existing supporting organizations. 8 Because of ongoing disagreement among Internet stakeholders about how individuals should participate in ICANN?s efforts, ICANN?s Board referred the question to a new Committee on ICANN Evolution and Reform. Under the current bylaws, the 9 current at- large Board seats will cease to exist after ICANN?s 2002 annual meeting, to be held later this year. Although the MOU calls on ICANN to design, develop, and test its procedures, the two tasks involving the adoption of the at- large membership process were removed from the MOU when it was amended in August 2000. However, as we have noted, this process was not fully implemented at the time of the amendment because the election did not take place until October 2000, and the evaluation committee did not release its final report until November 2001. When we discussed this amendment with Department officials, they said that they agreed to the removal of the tasks in August 2000 because ICANN had a process in place to complete them. Nearly 2 years later, however, the issue of how to structure ICANN?s Board to achieve broad representation continues to be unresolved and has been a highly contentious issue at ICANN?s recent public meetings. In addition, the amended MOU tasked ICANN with developing and testing an independent review process to address claims by members of the Internet community who were adversely affected by ICANN Board decisions that conflicted with ICANN?s bylaws. However, ICANN was unable to find qualified individuals to serve on a committee charged with implementing this policy. In March 2002, ICANN?s Board referred this unresolved matter to the Committee on ICANN Evolution and Reform for further consideration. 7 See http:// www. atlargestudy. org/ final_ report. shtml 8 See http:// www. naisproject. org/ report/ final/ Page 11 GAO- 02- 805T In the summer of 2001, ICANN?s current president was generally optimistic about the corporation?s prospects for successfully completing the remaining transition tasks. However, in the face of continued slow progress on key aspects of the transition, such as reaching formal agreements with the root server and country- code domain operators, his assessment changed. In February 2002, he reported to ICANN?s Board that the corporation could not accomplish its assigned mission on its present course and needed a new and reformed structure. The president?s proposal for reform, which was presented to ICANN?s Board in February, focused on problems he perceived in three areas: (1) too little participation in ICANN by critical entities, such as national governments, business interests, and entities that share responsibility for the operation of the domain name system (such as root server operators and countrycode domain operators); (2) too much focus on process and representation and not enough focus on achieving ICANN?s core mission; and (3) too little funding for ICANN to hire adequate staff and cover other expenditures. He added that in his opinion, there was little time left to make necessary reforms before the ICANN experiment came to ?a grinding halt.? Several of his proposed reforms challenged some of the basic approaches for carrying out the transition. For example, the president concluded that a totally private sector management model had proved to be unworkable. He proposed instead a ?well- balanced public- private partnership? that involved an increased role for national governments in ICANN, including having several voting members of ICANN?s Board selected by national governments. The president also proposed changes that would eliminate global elections of at- large Board members by the Internet community, reduce the number of Board members selected by ICANN?s supporting organizations, and have about a third of the board members selected through a nominating committee composed of Board members and others selected by the Board. He also proposed that ICANN?s funding sources be broadened to include national governments, as well as entities that had agreements with ICANN or received services from ICANN. In response, ICANN?s Board instructed an internal Committee on ICANN Evolution and Reform (made up of four ICANN Board members) to consider the president?s proposals, along with reactions and suggestions from the Internet community, and develop recommendations for the Board?s consideration on how ICANN could be reformed. The Committee reported back on May 31, 2002, with recommendations reflecting their views on how the reform should be implemented. For example, the committee built on the ICANN president?s earlier proposal to change the ICANN?s President Calls for Major Reform of the Corporation Page 12 GAO- 02- 805T composition of the Board and have some members be selected through a nominating committee process, and to create an ombudsman to review complaints and criticisms about ICANN and report the results of these reviews to the Board. In other cases, the committee agreed with conclusions reached by the president (such as the need for increasing the involvement of national governments in ICANN and improving its funding), but did not offer specific recommendations for addressing these areas. The committee?s report, which is posted on ICANN?s public Web site, invited further comment on the issues and recommendations raised in preparation for ICANN?s June 2002 meeting in Bucharest, Romania. The committee recommended that the Board act in Bucharest to adopt a reform plan that would establish the broad outline of a reformed ICANN, so that the focus could be shifted to the details of implementation. The committee believed that this outline should be then be filled in as much as possible between the Bucharest meeting and ICANN?s meeting in Shanghai in late October 2002. As mentioned previously, the Department is responsible for general oversight of work done under the MOU, as well as the responsibility for determining when ICANN, the private sector entity chosen by the Department to carry out the transition, has demonstrated that it has the resources and capability to manage the domain name system. However, the Department?s public assessment of the status of the transition process has been limited in that its oversight of ICANN has been informal, it has not issued status reports, and it has not publicly commented on specific reform proposals being considered by ICANN. According to Department officials, the Department?s relationship with ICANN is limited to its agreements with the corporation, and its oversight is limited to determining whether the terms of these agreements are being met. 9 They added that the Department does not involve itself in the internal governance of ICANN, is not involved in ICANN?s day- to- day operations, and would not intervene in ICANN?s activities unless the 9 In a July 2000 report prepared in response to a congressional mandate, we reviewed questions and issues related to the legal basis and authority for the Department?s relationship with ICANN. U. S. General Accounting Office, Department of Commerce: Relationship with the Internet Corporation for Assigned Names and Numbers, GAO/ OCG- 00- 33R (Washington, D. C.: July 7, 2000). This report discusses the development of the MOU, as well as other agreements related to the ongoing technical operation of the domain name system. We list the various agreements between ICANN and the Department in appendix II, which also lists significant events in the history of the domain name system. The Department?s Public Assessment of the Transition?s Progress Has Been Limited Page 13 GAO- 02- 805T corporation?s actions were inconsistent with the terms of its agreements with the Department. Department officials emphasized that because the MOU defines a joint project, decisions regarding changes to the MOU are reached by mutual agreement between the Department and ICANN. In the event of a serious disagreement with ICANN, the Department would have recourse under the MOU to terminate the agreement. 10 Department officials characterized its limited involvement in ICANN?s activities as being appropriate and consistent with the purpose of the project: to test ICANN?s ability to develop the resources and capability to manage the domain name system with minimal involvement of the U. S. government. Department officials said that they carry out their oversight of ICANN?s MOU- related activities mainly through ongoing informal discussions with ICANN officials. They told us that there is no formal record of these discussions. The Department has also retained authority to approve certain activities under its agreements with ICANN, such as reviewing and approving certain documents related to root server operations. This would include, for example, agreements between ICANN and the root server operators. In addition, the Department retains policy control over the root zone file, the ?master file? of top- level domains shared among the 13 root servers. Changes to this file, such as implementing a new top- level domain, must first be authorized by the Department. In addition, the Department sends officials to attend ICANN?s public forums and open Board of Directors meetings, as do other countries and Internet interest groups. According to the Department, it does not participate in ICANN decision- making at these meetings but merely acts as an observer. The Department also represents the United States on ICANN?s Governmental Advisory Committee, which is made up of representatives of about 70 national governments and intergovernmental bodies, such as treaty organizations. The Committee?s purpose is to provide ICANN with nonbinding advice on ICANN activities that may relate to concerns of governments, particularly where there may be an interaction between ICANN?s policies and national laws or international agreements. 10 If the Department withdraws its recognition of ICANN by terminating the MOU, ICANN has agreed to assign to the Department any rights that ICANN has in all existing contracts with registrars and registries. Page 14 GAO- 02- 805T The Department made a considerable effort at the beginning of the transition to create an open process that solicited and incorporated input from the public in formulating the guiding principles of the 1998 White Paper. However, since the original MOU, the Department?s public comments on the progress of the transition have been general in nature and infrequent, even though the transition is taking much longer than anticipated. The only report specifically called for under the MOU is a final joint project report to document the outcome of ICANN?s test of the policies and procedures designed and developed under the MOU. This approach was established at a time when it was expected that the project would be completed by September 2000. So far, there has been only one instance when the Department provided ICANN with a formal written assessment of the corporation?s progress on specific transition tasks. This occurred in June 1999, after ICANN took the initiative to provide the Department and the general public with a status report characterizing its progress on MOU activities. In a letter to ICANN, the Department stated that while ICANN had made progress, there was still important work to be done. For, example, the Department stated that ICANN?s ?top priority? must be to complete the work necessary to put in place an elected Board of Directors on a timely basis, adding that the process of electing at- large directors should be complete by June 2000. ICANN made the Department?s letter, as well as its positive response, available to the Internet community on its public Web site. Although ICANN issued additional status reports in the summers of 2000 and 2001, the Department stated that it did not provide written views and recommendations regarding them, as it did in July 1999, because it agreed with ICANN?s belief that additional time was needed to complete the MOU tasks. Department officials added that they have been reluctant to comment on ICANN?s progress due to sensitivity to international concerns that the United States might be seen as directing ICANN?s actions. The officials stated that they did not plan to issue a status report at this time even though the transition is well behind schedule, but will revisit this decision as the September 2002 termination date for the MOU approaches. When we met with Department officials in February 2002, they told us that substantial progress had been made on the project, but they would not speculate on ICANN?s ability to complete its tasks by September 2002. The following week, ICANN?s president released his report stating that ICANN could not succeed without fundamental reform. In response, Department officials said that they welcomed the call for the reform of ICANN and would follow ICANN?s reform activities and process closely. When we Page 15 GAO- 02- 805T asked for their views on the reform effort, Department officials stated that they did not wish to comment on specifics that could change as the reform process proceeds. To develop the Department?s position on the effort, they said that they are gathering the views of U. S. business and public interest groups, as well as other executive branch agencies, such as the Department of State; the Office of Management and Budget; the Federal Communications Commission; and components of the Department of Commerce, such as the Patent and Trademark Office. They also said that they have consulted other members of ICANN?s Governmental Advisory Committee to discuss with other governments how best to support the reform process. They noted that the Department is free to adjust its relationship with ICANN in view of any new mission statement or restructuring that might result from the reform effort. Department officials said that they would assess the necessity for such adjustments, or for any legislative or executive action, depending on the results of the reform process. In conclusion, Mr. Chairman, the effort to privatize the domain name system has reached a critical juncture, as evidenced by slow progress on key tasks and ICANN?s current initiative to reevaluate its mission and consider options for reforming its structure and operations. Until these issues are resolved, the timing and eventual outcome of the transition effort remain highly uncertain, and ICANN?s legitimacy and effectiveness as the private sector manager of the domain name system remain in question. In September 2002, the current MOU between the Department and ICANN will expire. The Department will be faced with deciding whether the MOU should be extended for a third time, and if so, what amendments to the MOU are needed, or whether some new arrangement with ICANN or some other organization is necessary. The Department sees itself as the responsible steward of the transition, and is responsible for gaining assurance that ICANN has the resources and capability to assume technical management of the Internet domain name system. Given the limited progress made so far and the unsettled state of ICANN, Internet stakeholders have a need to understand the Department?s position on the transition and the prospects for a successful outcome. In view of the critical importance of a stable and secure Internet domain name system to governments, business, and other interests, we recommend that the Secretary of Commerce issue a status report detailing the Department?s assessment of the progress that has been made on transition tasks, the work that remains to be done on the joint project, and Conclusion Recommendation Page 16 GAO- 02- 805T the estimated timeframe for completing the transition. In addition, the status report should discuss any changes to the transition tasks or the Department?s relationship with ICANN that result from ICANN?s reform initiative. Subsequent status reports should be issued periodically by the Department until the transition is completed and the final project report is issued. This concludes my statement, Mr. Chairman. I will be pleased to answer any questions that you and other Members of the Subcommittee may have. For questions regarding this testimony, please contact Peter Guerrero at (202) 512- 8022. Individuals making key contributions to this testimony included John P. Finedore; James R. Sweetman, Jr.; Mindi Weisenbloom; Keith Rhodes; Alan Belkin; and John Shumann. Contact and Acknowledgments Page 17 GAO- 02- 805T Although the U. S. government supported the development of the Internet, no single entity controls the entire Internet. In fact, the Internet is not a single network at all. Rather, it is a collection of networks located around the world that communicate via standardized rules called protocols. These rules can be considered voluntary because there is no formal institutional or governmental mechanism for enforcing them. However, if any computer deviates from accepted standards, it risks losing the ability to communicate with other computers that follow the standards. Thus, the rules are essentially self- enforcing. One critical set of rules, collectively known as the domain name system, links names like www. senate. gov with the underlying numerical addresses that computers use to communicate with each other. Among other things, the rules describe what can appear at the end of a domain name. The letters that appear at the far right of a domain name are called top- level domains (TLDs) and include a small number of generic names such as .com and .gov, as well as country- codes such as .us and .jp (for Japan). The next string of text to the left (? senate? in the www. senate. gov example) is called a second- level domain and is a subset of the top- level domain. Each top- level domain has a designated administrator, called a registry, which is the entity responsible for managing and setting policy for that domain. Figure 2 illustrates the hierarchical organization of domain names with examples, including a number of the original top- level domains and the country- code domain for the United States. Appendix I: Overview of the Domain Name System Page 18 GAO- 02- 805T Figure 2: The Hierarchical Organization of Internet Domain Names Source: GAO. The domain name system translates names into addresses and back again in a process transparent to the end user. This process relies on a system of servers, called domain name servers, which store data linking names with numbers. Each domain name server stores a limited set of names and numbers. They are linked by a series of 13 root servers, which coordinate the data and allow users to find the server that identifies the site they want to reach. They are referred to as root servers because they operate at the root level (also called the root zone), as depicted in figure 2. Domain name servers are organized into a hierarchy that parallels the organization of the domain names. For example, when someone wants to reach the Web site Page 19 GAO- 02- 805T at www. senate. gov, his or her computer will ask one of the root servers for help. 11 The root server will direct the query to a server that knows the location of names ending in the .gov top- level domain. If the address includes a sub- domain, the second server refers the query to a third server- in this case, one that knows the address for all names ending in senate. gov. This server will then respond to the request with an numerical address, which the original requester uses to establish a direct connection with the www. senate. gov site. Figure 3 illustrates this example. Figure 3: How the Domain Name System Translates a Web Site Name Into an Address Source: GAO. Within the root zone, one of the servers is designated the authoritative root (or the ?A root? server). The authoritative root server maintains the master copy of the file that identifies all top- level domains, called the ?root zone file,? and redistributes it to the other 12 servers. Currently, the authoritative root server is located in Herndon, Virginia. In total, 10 of the 13 root servers are located in the United States, including 3 operated by 11 This example assumes that the required domain name information is not available on the user?s local network. Page 20 GAO- 02- 805T agencies of the U. S. government. ICANN does not fund the operation of the root servers. Instead, they are supported by the efforts of individual administrators and their sponsoring organizations. Table 1 lists the operator and location of each root server. Table 1 : Operators and Locations of the 13 Internet Root Servers Affiliation of volunteer root server operator Location of server VeriSign (designated authoritative root server) Herndon, VA Information Sciences Institute, University of Southern California Marina del Rey, CA PSI net Herndon, VA University of Maryland College Park, MD National Air and Space Administration Mountain View, CA Internet Software Consortium Palo Alto, CA Defense Information Systems Agency, U. S. Department of Defense Vienna, VA Army Research Laboratory, U. S. Department of Defense Aberdeen, MD NORDUnet Stockholm, Sweden VeriSign Herndon, VA RIPE (the Regional Internet Registry for Europe and North Africa) London, UK ICANN Marina del Rey, CA WIDE (an Internet research consortium) Tokyo, Japan Source: ICANN?s Root Server System Advisory Committee. Because much of the early research on internetworking was funded by the Department of Defense (DOD), many of the rules for connecting networks were developed and implemented under DOD sponsorship. For example, DOD funding supported the efforts of the late Dr. Jon Postel, an Internet pioneer working at the University of Southern California, to develop and coordinate the domain name system. Dr. Postel originally tracked the names and numbers assigned to each computer. He also oversaw the operation of the root servers, and edited and published the documents that tracked changes in Internet protocols. Collectively, these functions became known as the Internet Assigned Numbers Authority, commonly referred to as IANA. Federal support for the development of the Internet was also provided through the National Science Foundation, which funded a network designed for academic institutions. Two developments helped the Internet evolve from a small, text- based research network into the interactive medium we know today. First, in 1990, the development of the World Wide Web and associated programs called browsers made it easier to view text and graphics together, sparking Page 21 GAO- 02- 805T interest of users outside of academia. Then, in 1992, the Congress enacted legislation for the National Science Foundation to allow commercial traffic on its network. Following these developments, the number of computers connected to the Internet grew dramatically. In response to the growth of commercial sites on the Internet, the National Science Foundation entered into a 5- year cooperative agreement in January 1993 with Network Solutions, Inc., to take over the jobs of registering new, nonmilitary domain names, including those ending in .com, .net, and .org, and running the authoritative root server. 12 At first, the Foundation provided the funding to support these functions. As demand for domain names grew, the Foundation allowed Network Solutions to charge an annual fee of $50 for each name registered. Controversy surrounding this fee was one of the reasons the United States government began its efforts to privatize the management of the domain name system. 12 Network Solutions later merged with VeriSign. The new company currently uses the VeriSign name. Under its original agreement with the National Science Foundation, Network Solutions was also responsible for registering second- level domain names in the restricted .gov and .edu top- level domains. Page 22 GAO- 02- 805T Working under funding provided by the Department of Defense, a group led by Drs. Paul Mockapetris and Jon Postel creates the domain name system for locating networked computers by name instead of by number. Dr. Postel publishes specifications for the first six generic top- level domains (. com, .org, .edu, .mil, .gov, and .arpa). By July 1985, the .net domain was added. President Bush signs into law an act requiring the National Science Foundation to allow commercial activity on the network that became the Internet. Network Solutions, Inc., signs a 5- year cooperative agreement with the National Science Foundation to manage public registration of new, nonmilitary domain names, including those ending in .com, .net, or .org. President Clinton issues a presidential directive on electronic commerce, making the Department of Commerce the agency responsible for managing the U. S. government?s role in the domain name system. The Department of Commerce issues the ?Green Paper,? which is a proposal to improve technical management of Internet names and addresses through privatization. Specifically, the Green Paper proposes a variety of issues for discussion, including the creation of a new nonprofit corporation to manage the domain name system. In response to comments on the Green Paper, the Department of Commerce issues a policy statement known as the ?White Paper,? which states that the U. S. government is prepared to transition domain name system management to a private, nonprofit corporation. The paper includes the four guiding principles of privatization: stability; competition; representation; and private, bottom- up coordination. The Internet Corporation for Assigned Names and Numbers (ICANN) incorporates in California. ICANN?s by- laws call for a 19- member Board with 9 members elected ?at- large.? The Department of Commerce and ICANN enter into an MOU that states the parties will jointly design, develop, and test the methods and procedures necessary to transfer domain name system management to ICANN. The MOU is set to expire in September 2000. Appendix II: Important Events in the History of the Domain Name System Nov. 1983 Oct. 1984 Nov. 1992 Jan. 1993 July 1997 Jan. 1998 June 1998 Nov. 1998 Nov. 1998 Page 23 GAO- 02- 805T ICANN issues its first status report, which lists ICANN?s progress to date and states that there are important issues that still must be addressed. ICANN and the Department of Commerce enter into a cooperative research and development agreement to study root server stability and security. The study is intended to result in a final report by September 2000. ICANN and the Department of Commerce approve MOU amendment 1 to reflect the roles of ICANN and Network Solutions, Inc. The Department of Commerce contracts with ICANN to perform certain technical management functions related to the domain name system, such as address allocation and root zone coordination. At a meeting in Cairo, Egypt, ICANN adopts a process for external review of its decisions that utilizes outside experts, who will be selected at an unspecified later date. ICANN also approves a compromise whereby 5 atlarge Board members will be chosen in regional online elections. ICANN issues its second Status Report, which states that several of the tasks have been completed, but work on other tasks was still under way. At a meeting in Yokahama, Japan, ICANN?s Board approves a policy for the introduction of new top- level domains. The Department of Commerce and ICANN approve MOU amendment 2, which deleted tasks related to membership mechanisms, public information, and registry competition and extended the MOU until September 2001. They also agree to extend the cooperative research and development agreement on root server stability and security through September 2001. ICANN holds worldwide elections to replace 5 of the 9 interim Board members appointed at ICANN?s creation. At a meeting in California, ICANN selects 7 new top- level domain names: .biz (for use by businesses), .info (for general use), .pro (for use by professionals), .name (for use by individuals), .aero (for use by the air transport industry), .coop (for use by cooperatives), and .museum (for use by museums). June 1999 June 1999 Nov. 1999 Feb. 2000 Mar. 2000 June 2000 July 2000 Aug. 2000 Oct. 2000 Nov. 2000 Page 24 GAO- 02- 805T The Department of Commerce enters into a second contract with ICANN regarding technical functions of the domain name system. ICANN and the Department of Commerce approve MOU amendment 3, which conforms the MOU with the Department?s new agreement with VeriSign (formerly Network Solutions.) ICANN issues its third Status Report, which states that most of the tasks in the MOU are either complete or well on their way to completion. ICANN?s At- Large Membership Study Committee issues a preliminary report that recommends creating a new at- large supporting organization. The new organization would be open to anyone with a domain name and would elect 6 members of ICANN?s Board of Directors. The Department of Commerce and ICANN agree to extend the MOU through September 2002 and the cooperative research and development agreement through June 2002 (amendment 4). Following the September 11 terrorist attacks, ICANN devotes the bulk of its annual meeting to security issues. The At- large Membership Study Committee releases its final report, which retains the Board reorganization first proposed in August 2001. ICANN president Dr. M. Stuart Lynn releases a proposal for the reform of ICANN. At a Board meeting in Ghana, ICANN?s Board refers Dr. Lynn?s proposal and questions about at- large representation and outside review to an internal Committee on ICANN Evolution and Reform. The Department of Commerce exercises an option in its contract with ICANN regarding the technical functions of the domain name system, extending it through September 2002. ICANN?s Committee on Evolution and Reform reports its recommendations to ICANN?s Board. ICANN?s Board is scheduled to meet in Bucharest, Romania. ICANN?s Board is scheduled to meet in Shanghai, China Mar. 2001 May 2001 July 2001 Aug. 2001 Sep. 2001 Nov. 2001 Feb. 2002 Mar. 2002 Apr. 2002 May 2002 June 2002 Oct. 2002 (545001) *** End of document. ***